AMENDMENT AND RESPONSE UNDER 37 CFR § 1.11 1 Pa 8 e 3 

Serial Number: 10/034,689 Dkt: 1 488.0 15US1 

Filing Date: December 28, 2001 

Title: A METHOD OF NETWORK MODELING AND PREDICTIVE EVENT CORRELATION IN A COMMUNICATION SYSTEM BY 
THE USE OF CONTEXTUAL FUZZY COGNITIVE MAPS 



IN THE SPECIFICATION 

Please amend the specification as follows: 

The paragraph beginning at page 5, line 16 is amended as follows: 
Another aspect of the present invention is [[a]] for an improved event-correlation system 
that better serves the needs specific to communication networks. The method is performed by 
forming fuzzy cognitive map fragments using the network element interdependencies derived 
from a database defining the network managed objects and event notifications that convey the 
state of one or more managed objects. The method then requires sampling generated incoming 
real-time events from the communication network. The sampled events are then mapped to the 
FCM fragments to diagnose the problem. 

The paragraph beginning at page 11, line 17 is amended as follows: 
FCMs may be used for network modeling. An FCM is a sing e d signed directed graph, 
where nodes represent events and edges represent the partial causal flow between nodes. The 
node in an FCM in a communication network context typically represents an elementary event 
(state of a managed object) or a network concept such as performance degradation. The edge can 
indicate positive or negative causal influence. A positive edge can imply that the occurrence of 
one event can cause the occurrence of another event (P can imply Q), while a negative edge can 
imply that the occurrence of one event can nullify the effect of the other event in the 
communication system (P can nullify Q). An FCM state may be represented as a vector at any 
given time. 

The paragraph beginning at page 13, line 21 is amended as follows: 
Cj can also be decomposed into a quantifier (Qj) set and a modifier (Mi) set. From the 
above example, Qi e Q a = {good, not_so_good, bad}, and Mi = {PERFORMANCE, FAULT} 
where Q a defines the partial ordering of quantifiers for each Qi e Q a . The causal abstract 
negation of Qi is defined as -Qi, and Qi and ~Qi are symmetrical quantifiers. A median quantifier 
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value is also defined. An example of a quantifier set 200 that can be used in event-correlation is 
shown in Figure 2. In the example, 'Bad' [[210]]230 is the abstract negation of 'Good' 
[[220]]210 and 'moderate' [[230]]220 is the median quantifier. 

The paragraph beginning at page 23, line 1 1 is amended as follows: 
Creating FCM fragments involves finding relationships between concepts. The evidence 
available through studying network data or event logs or through an expert typically dictates the 
numerical values for a pair of concepts or objects. Referring to Figure [[13]] H, the "Buffer 
overflow" node 1 120 has two contexts 1 1 10 and 1 130 and "increases" 1 1 15 in these two 
contexts 1 1 10 and 1 130 can have two different numerical values. The numerical values 
associated with the link partial order linguistic variables depend on the network context. For 
example, consider the fragment 1 100 shown in Figure 1 1 . The increase = n l ]2 < 0.50 of FCM 
fragment 1 100 of Figure 1 1 was determined through a combination of expert opinion, network 
context and through trials where the effect of ipInReceives on Buffer flow was quantified to less 
than 0.50. FCM fragment increases = ja I 2 3 > 0.75 was determined through expert opinion, 
network context and through trials where the effect of icmpInSrcQuench on Buffer flow was 
quantified to greater than 0.75. 

The paragraph beginning at page 24, line 1 is amended as follows: 
In the given FCM fragment 1400, the shaded nodes are the concept nodes 1420 and the 
unshaded nodes 1410 are the network managed object nodes. The managed object nodes 1410 in 
the FCM fragment 1400 are counters whose values continue to increment. The count value from 
the managed objects, which arrives through a SNMP or a CMIP message, can be evaluated to 
establish the degree of evidence, as explained above. In Figure 14, the tail nodes are nodes with 
text "icmpInRedirects", "ipOutRout e s" "ipOutNoRoutes" , "icmpInDestUnreaches", and the node 
with text "Performance degradation is a head node. The head concept nodes with text 
"Performance degradation" are critical nodes. Further evidence calculation can be required when 
there is 'moderate' evidence flow. 
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